93e15e4e7863b8b0841db7725746afa287057942958d45e484dd6037fbb704f9 | Triage

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 10:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

93e15e4e7863b8b0841db7725746afa287057942958d45e484dd6037fbb704f9.dll
Size

4KB
MD5

1c0998bb976568c746b8ef1ba9c85f10
SHA1

efa1522e3affa594d2bafa6ad6512c743d839c4c
SHA256

93e15e4e7863b8b0841db7725746afa287057942958d45e484dd6037fbb704f9
SHA512

3a6d5c9d32555f7424352491e97bf69cb51977dc0ed9cb0912178ed6d68467b6c682888fc91de4bed9c995f1f1990ca1f9382bb678373346e66a951898611b3b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\93e15e4e7863b8b0841db7725746afa287057942958d45e484dd6037fbb704f9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\93e15e4e7863b8b0841db7725746afa287057942958d45e484dd6037fbb704f9.dll,#1
  2⤵
  PID:540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/540-55-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download